AccidentalManufacturingManufacturingMisconfigurationDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumContained

Polaris Industries Inc.

bd_b6573d53b6231c53 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 8, 2013

Filed

Jun 7, 2013

To disclose

4 weeks

Affected

10state residents only

Linked

2 filings

Confidence

66%

Full breach record for Polaris Industries Inc. →

Polaris Industries Inc. notified the NH AG of a security deficiency where dealer applications (April 2007-May 2013) were inadvertently accessible online via exact URL. Data included names, SSNs, and financial account numbers. 10 NH residents affected. Polaris disabled the site and notified individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2229 days

discovery → filing · 4 weeks / 30 days

Apr 1, 2007

Begins

May 8, 2013

Discovered

Jun 7, 2013

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_81b15dc777bb095e2013-06-10 · +3dVerified

Name: Polaris Industries Inc.
norm: polaris industries

Name: Polaris Industries Inc.
norm: polaris industries
Industry: Manufacturingllm

Discovered: May 8, 2013
Breach occurred: Apr 1, 2007 – May 8, 2013
Undetected for: 2,229 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 10, 2013
Affected individuals: 10state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection
Regulator citations: Notified New Hampshire Attorney General

During the incident: Disabled the entire dealer application site
Sent a letter to affected individuals notifying them of the incident
Changes made: Will use this incident as an opportunity to evaluate its data privacy and security practices to ensure it maintains appropriate safeguards to protect individuals’ personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGJun 7 · first · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/polaris-industries-20130607.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 7, 2013
Raw hash: 6e453deb7fdb6ef21ccb69c31eca319f0a1fbbafdaa2b950b3ea7e27d2c1d8ef

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityPolaris Industries Inc.

Victim entityPolaris Industries Inc.

Incidentdiscovered May 8, 2013

Stated responseDisabled the entire dealer application site

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov